Please note that the senior management is always in the loop for the phishing tests along with some of the security team. It's just the users who are not told.

Please note that the senior management is always in the loop for the phishing tests along with some of the security team. It's just the users who are not told. You can't just send out a phishing email without telling anyone about it, you are liable to get fired for it. Remember the first rule of cybersecurity testing is to get written permission and then establish rules of engagement. All these researchers had to do was reach out to Greg, loop him in the study to get his go ahead for it. Now that several of these 'patches' are now in stable and in fact did introduce issues is a big problem and a major waste of time for the maintainers.